Security issue: iojs is run as root #23

Activity

1. mtparet commented on Feb 7, 2015

   

   mtparet

   on Feb 7, 2015

   Author

   More actions

   cf also nodejs/docker-node#1
2. pesho commented on Feb 8, 2015

   

   pesho

   on Feb 8, 2015

   Contributor

   More actions

   Something like:

   # Use high uid/gid to avoid collisions with the host
   RUN groupadd --gid 25000 app && useradd --uid 25000 --gid 25000 --create-home --shell /bin/bash app 

   ...folowed by this just before CMD:

   USER app

   ...and also modifying onbuild to use e.g. /home/app/src as base.

   Does this sound right?
3. mtparet commented on Feb 8, 2015

   

   mtparet

   on Feb 8, 2015

   Author

   More actions

   Yes sounds right !
4. pesho

   self-assigned this

   on Feb 11, 2015
5. pesho

   removed their assignment

   on Apr 3, 2015
6. pesho commented on Apr 3, 2015

   

   pesho

   on Apr 3, 2015

   Contributor

   More actions

   Un-assigning this, in case anyone else wants to give it a try.
7. hmalphettes commented on Apr 4, 2015

   

   hmalphettes

   on Apr 4, 2015

   Member

   More actions

   @pesho I'll give it a shot sometimes next week as I actually need this for a customer.
   Feel free to assign it to me or simply wait for a PR when it is ready enough.
8. Starefossen commented on Apr 4, 2015

   

   Starefossen

   on Apr 4, 2015

   Member

   More actions

   @hmalphettes you have probably read this comment in #26, but just to make sure:

   yosifkit commented on Feb 16
   I think the hardest part here is that this still doesn't cover the developer that wants to bind mount in their code so that they can edit it on their host machine and see changes as they develop using something like node-supervisor (ex: docker run -it --rm -v /my/code:/usr/src/app my-node). That way they do not have to docker stop, docker build, and docker run for every change.
9. Starefossen

   added

   discussion

   on Apr 17, 2015
10. retrohacker commented on Oct 14, 2015

    

    retrohacker

    on Oct 14, 2015

    Contributor

    More actions

    User namespaces have made it into the experimental release of Docker. moby/moby#12648